It’s sometimes difficult for traditional Computer Forensic (CF) examiners to understand why they should treat video and multimedia any differently than other types of digital evidence. After all, a bit is a bit, and a byte is a byte. Right? CF examiners are typically highly trained and highly technical people. If anyone is going to understand how to recover and interpret multimedia data, one would think that a traditional CF examiner would be at or near the top of your go-to list. The problem with this assumption is that multimedia data is fundamentally different than most other types of data, and in more than one way.

* Updated with Corrected Images & Explanations. 

After the break you'll find several images of a bogus Person of Interest (PoI) that were recorded by a DCCTV system. Two different analog CCTV cameras with built-in IR illuminators were connected to the black-box, h.264 DVR. These JPG images were exported from the DVR’s proprietary player. All of these images exported at 704 pixels by 480 pixels. When the recorded video is played back via the proprietary player it is displayed at 630 x 455; however, analysis of the proprietary file and exported AVI files reveals both of those contain a 704 x 480 video stream.

Your task, should you choose to accept it, is to:

• Describe the PoI’s clothing items from these images as you would for producing a BOLO. Note any issues that may affect your description.
• Identify the single most important correction that should be made to these images prior to printing. (BONUS - Why does this correction need to be made, and what tipped you off to it?)

If you’ve taken one of my recovery classes or attended one of my presentations on the topic at a LEVA conference or other event, you may have seen these examples.